DFSG NEW review for zoitechat-otr version 0.2.2~git20260225-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: absent
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree (18 upstream text files, all read) is GPL-2+ except the single AppStream metainfo file declared CC0-1.0; no binaries, minified files, non-free terms, or unlicensed code. debian/copyright is machine-readable DEP-5 1.0, its stanzas match every file (Files:* catch-all for the fork/meson/readme/config files, explicit stanzas for the Uli Meis irssi-otr sources and the metainfo), holders are named and complete, GPL-2+/CC0-1.0 short names match the actual headers and texts, and the GPL-2+ and CC0-1.0 texts are correctly pointed at /usr/share/common-licenses. The two licences are compatible. I found no inaccurate or missing statement.

Packaging

control/rules/changelog/source/format are clean: debhelper-compat 14 with dh and the meson buildsystem, override_dh_auto_configure passes -Dlocal_install=false, hardening=+all, Rules-Requires-Root: no, Standards-Version 4.7.4 vs current Policy 4.7.4.1. Every Build-Depends exists in the archive (verified via apt-cache: zoitechat, zoitechat-dev, libotr5-dev, libgcrypt20-dev). The binary stanza correctly has no Depends (compat 14 auto-adds shlibs/misc substvars), and Enhances: zoitechat is a valid relationship for an optional host plugin; Multi-Arch: same on a compiled plugin package matches the established hexchat-plugins precedent. Changelog is sane and closes a bug. Nothing needs fixing.

Issues

1. [minor] [packaging] There is no debian/watch

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Problem: Without a watch file new upstream releases are not noticed by uscan, the tracker or the maintainer's tools.
• Fix: Add a debian/watch in version 5 format, or, if upstream has no usable release channel, one holding a comment that says so.

Verified

• debian/copyright read in full: DEP-5 Format 1.0 with the exact canonical URL; stanzas Files: * (GPL-2+, holders 2014 adhux, 2014-2016 Patrick Griffis, 2026 deepend-tildeclub), Files: data/io.github.zoitechat.Plugin.OTR.metainfo.xml (CC0-1.0, deepend_AT_zoite.net), Files: src/makeformats.py src/otr.h src/otr_key.c src/otr_ops.c src/otr_util.c (2008 Uli Meis, GPL-2+), Files: debian/* (2016 Petter Reinholdtsen, 2026 Bastian Germann, GPL-2+), plus a correct standalone GPL-2+ License paragraph pointing at common-licenses/GPL-2.
• Every upstream file examined (glob with gitignore:false of the whole tree, all 18 files read or inspected): all plain text source, data and build files; no binaries, minified code, fonts, images, archives, firmware or generated-code-without-source.
• File headers verified individually: src/otr.h, otr_key.c, otr_ops.c, otr_util.c and makeformats.py each carry Copyright (C) 2008 Uli Meis <a.sporto+bee@gmail.com> plus the GPL-2+ notice (either version 2 of the License, or (at your option) any later version); src/zoitechat_otr.c and zoitechat_otr.h carry the GPL-2+ notice (no copyright line) and are matched by Files: *.
• data/io.github.zoitechat.Plugin.OTR.metainfo.xml declares <project_license>GPL-2.0+</project_license> and <metadata_license>CC0-1.0</metadata_license>, matching the GPL-2+ Files: * and the CC0-1.0 stanza with the common-licenses/CC0-1.0 pointer.
• LICENSE contains the plain GPL v2 text; the project's files use GPL-2+, so License: GPL-2+ is the correct short name.
• Prescan (dfsg-author-check) over 17 files: every copyright holder found is named in debian/copyright; no unrepresented holder. Its whole list is the file tree itself, accounted for above.
• Packaging files read: debian/control (debhelper-compat (= 14), Build-Depends libgcrypt20-dev/libglib2.0-dev/libotr5-dev/meson/pkgconf/python3:any/zoitechat-dev, Standards-Version 4.7.4, Rules-Requires-Root: no, Architecture any, Multi-Arch: same, Enhances: zoitechat), debian/rules (dh $@ --buildsystem=meson, override_dh_auto_configure with -Dlocal_install=false, hardening=+all), debian/changelog (0.2.2~git20260225-1 unstable, urgency medium, Closes: #1137179), debian/source/format (3.0 (quilt)).
• apt-cache confirms every Build-Depends name exists in the archive: zoitechat 2.19.1-1, zoitechat-dev 2.19.1-1 (Multi-Arch: same, ships zoitechat-plugin.pc), libotr5-dev 4.1.1-7, libgcrypt20-dev 1.12.4-2.
• Policy tool gives current Policy 4.7.4.1, so Standards-Version 4.7.4 is current (first two components match).
• Multi-Arch: same on a compiled plugin package is established practice: apt-cache shows hexchat-plugins (compiled plugins for a similar IRC host) is Multi-Arch: same.
• metainfo install path (chatprefix/datadir/metainfo via data/meson.build), not local_install, is correct without a separate -doc or -common split; no extra packages are needed.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC0-1.0, GPL-2).

Not confirmed

• No build was run (read-only review): shlibs:Depends generation (libc6, libgcrypt20, libglib2.0-0t64, libotr5t64) and the plugin install-dir value from zoitechatlibdir are confirmed from meson.build and precedent, not from a built .deb.
• The executable bit of src/makeformats.py in the tarball (meson's find_program requires it) could not be checked from here; upstream's own build depends on it.

Proposed changes

None.